Photo by Luke Southern on Unsplash
Something happened recently that security professionals have been warning about for some time. An AI agent, the kind of software that can take actions on your behalf without you clicking anything, was compromised and used to access sensitive data and carry out attacks on live systems. The organisation involved publicly apologised and described it as a new kind of cyber incident.
That phrase is worth sitting with. A new kind of incident. Not the same phishing email with a different disguise. Not ransomware under a fresh name. Something genuinely different in how it works and the damage it can cause.
What Sets This Apart From Previous AI Security Stories
Until now, most AI-related security concerns fell into a few familiar buckets. AI being used by criminals to write more convincing phishing messages. AI tools quietly sending your business data to third-party servers. AI chatbots being tricked into revealing things they should not.
This is something else entirely. The AI agent in this case was not a passive tool that got misused. It was an active participant in an attack. It had access to systems. It took actions. It caused real-world harm involving real people's data. That distinction matters enormously because the risk profile is completely different from anything that came before it.
We covered how AI browser agents can be hijacked mid-task when the technique first surfaced as a proof of concept. What is new here is that it has moved from theoretical demonstration to confirmed live incident.
Does This Affect UK Small Businesses?
Most small businesses are not running complex AI orchestration systems. But a surprising number are already using tools with agentic capabilities without thinking of them that way. An email assistant that can send messages on your behalf. A CRM integration that updates customer records automatically. A productivity tool connected to your calendar, files, and contacts that can act on spoken or typed instructions.
Each of those has three things attackers look for in any target: access, trust, and the ability to take consequential actions. If an attacker can get malicious instructions into your AI tool, whether through a crafted document, a poisoned data source, or a manipulated prompt, they may be able to get that tool to act on their behalf while it appears to be acting on yours.
That is not a hypothetical. It is the mechanism behind what happened in this incident. And it is why we also recently wrote about what agentic AI threats mean for small businesses as a growing category of risk.
The Simplest Frame: How Much Can It Actually Do?
There is a well-established security principle that says every user, system, and application should have exactly the access it needs to do its job, and nothing more. It is called least privilege, and it applies to AI tools just as directly as it applies to staff accounts.
If an AI assistant only needs to read your calendar, it should not also have access to your customer database. If it only needs to draft emails, it should not be able to send them without a human confirming. The broader the access, the greater the potential damage if the tool is compromised, manipulated, or simply misbehaves.
This is fundamentally an identity and access control problem. The same discipline of reviewing who or what has access to which systems, and reducing that access to the strict minimum, applies here. The fact that the account holder is software rather than a person does not change the underlying logic.
Three Questions to Ask About Every AI Tool You Use
- What can it actually do? Not the marketing description. What actions can it take, what systems does it connect to, and what data does it have permission to read or modify?
- What is the realistic worst case if it acts on instructions that did not come from you? If someone could trick it into sending emails, updating records, or extracting customer data, how much damage could that realistically cause?
- Is there a human decision point before the consequential actions? Automating low-stakes tasks is sensible. Automating actions with financial, legal, or data-privacy consequences without any human confirmation is a different judgement entirely.
This Is Not an Argument Against Using AI Tools
Refusing to use AI tools is not the right response, and it is not a realistic one either. They offer genuine practical value for small businesses, and that is not going to change. The right response is to use them with clear eyes about what access they have, review that access regularly, and keep a human in the loop for anything that truly matters.
It is also worth recognising that unusual automated activity is exactly the kind of signal that managed security monitoring is designed to detect. Actions being taken at unexpected times, by software that should not be acting in that way, in volumes or patterns that do not match normal use. Those are observable signals. The question is whether anyone is watching for them.
A Practical Starting Point
Go through every AI tool currently connected to your business systems. For each one, note what it can access and what it can do. Then ask honestly whether it needs all of that access to perform the function you actually use it for. If the answer is no, reduce the permissions. If you are not sure how, or you want someone to work through it with you, get in touch and we can help you assess where the gaps are.
The security fundamentals, knowing what is connected to your systems, controlling what it can do, and monitoring for unusual behaviour, matter just as much for AI tools as they do for any other account in your business. Start there, and you are already ahead of most.